I think you should read up on perlsec (Taint mode in particular). Otherwise you could try -attachment in header() and/or -type => "application/octet-stream". Are you sure that there is such a file under /tmp? Cheers.